ZeroDayAlert

CVE-2026-60004: Gitea Code Injection Vulnerability

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.

Gitea Gitea Added to KEV 2026-08-25 Federal due 2026-08-28 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Gitea installations are affected by a code injection vulnerability in the diffpatch API endpoint. The vulnerability requires an attacker to have write access to a repository; they can then exploit this to inject and execute shell commands with the privileges of the Gitea service account. The record does not specify which Gitea versions are vulnerable or whether self-hosted and cloud-hosted instances are equally at risk.

How to check whether this touches you

  • Inventory whether you operate or depend on Gitea instances in your environment, including any managed or cloud-hosted deployments.
  • Establish whether your Gitea instance accepts repository contributions from untrusted users or whether all writers are internal staff you control.
  • Check your network perimeter to confirm whether the Gitea web interface and API are reachable from the internet or restricted to internal networks only.
  • Query your Gitea logs for any use of the diffpatch API endpoint over the past six to twelve months; this is the attack surface for this vulnerability.
  • Contact your Gitea vendor or check the Gitea project advisories to confirm the exact version you are running and whether a patch or mitigation is available for it.

What to do

  1. Immediately review the Gitea project's official security advisory and vendor guidance to identify whether your version is affected and what patch or mitigation is available.
  2. If you cannot patch immediately, restrict write access to repositories to trusted internal users only; audit and revoke any external or service account credentials that have repository write permissions.
  3. If your Gitea instance is internet-facing, move it behind a firewall, VPN, or reverse proxy that requires authentication before the web interface is reachable; this reduces the window for exploitation.
  4. Enable comprehensive audit logging on your Gitea instance to capture all API requests to the diffpatch endpoint, repository writes, and Git hook creation events.
  5. Plan to apply the vendor's patch or mitigation within the timescale specified in CISA BOD 26-04; if no patch is available, escalate to your security team and evaluate whether continued operation of Gitea is acceptable for your risk profile.

If you find you were exposed

Exploitation of this vulnerability is likely to predate the public disclosure; conduct a retrospective search of your Gitea audit logs and system logs for the past six to twelve months for suspicious diffpatch API calls, unusual Git hook creation, and unexpected shell command execution by the Gitea service account. Retain and analyse logs from any repositories to which untrusted users had write access. If you lack sufficient log retention to cover the period since the vulnerability was introduced, document the gap and escalate to your incident response team for further investigation using filesystem and process forensics on the Gitea host.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-60004 is being exploited. It cannot tell you whether Gitea is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →